diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 9771baa2..c2d4acaa 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -724,6 +724,13 @@ in
       done
       if [ -d "$homeDir/.claude" ]; then
         chown -hR "$userName:$userName" "$homeDir/.claude" 2>/dev/null || true
+        # 0755 so hive-core (a different unix user) can list the dir and
+        # detect a valid claude session. Credential files inside are 0600
+        # so secrets stay private regardless of the directory mode.
+        # ensure_claude_dir sets 0755 on creation but cannot re-chmod after
+        # hive-agent-user-migrate chowns the dir to the agent user; this
+        # activation script runs as root and handles the correction.
+        chmod 755 "$homeDir/.claude" 2>/dev/null || true
       fi
     '';